It's a grey area (again, as I removeded elsewhere, because game companies are also against used sales and cross-region sales).

It can be stolen credit cards.

It can also be:

1. Games purchased during an unprecedented sale, then resold at a profit still well below current MSRP. Big game companies hate this.
2. Games purchased in one country to be resold in another, non-region-locked country. (note, my removed includes region locking)
3. Games purchased in bulk directly from the company or from an authorized reseller. Can relate to #2 as well.

But because everyone involved is in a grey area, there's not as much transparency from anyone exactly how many this is. G2A argued for years it was virtually zero, then admitted it's a bit higher than that. Is it 10%, 50%, somewhere in between? We actually don't know.